26 February 1997
Source: http://www.bxa.doc.gov/16-.pdf (238K)

Public Comments on Encryption Items Transferred from
the U.S. Munitions List to the Commerce Control List

16. America Online, Inc.

Before the
BUREAU OF EXPORT ADMINISTRATION
UNITED STATES DEPARTMENT OF COMMERCE
Washington, DC 20230

In the Matter of
Encryption Items Transferred
From the U.S. Munitions List
to the Commerce Control List

Docket No. 960918265-6366-03

COMMENTS OF AMERICA ONLINE, INC.

William W. Burrington
Director, Law and Public Policy
Assistant General Counsel
202/530-7880
BillBurr@aol.com

Thomas C. Dabney
Assistant General Counsel
AOL International
America Online, Inc.
22000 AOL Way
Dulles, VA 20166-9323
703/265-2020
DabneyTC@aol.com

and

Jill A. Lesser
Deputy Director, Law and Public Policy
Senior Counsel
202/530-7882
JillLess@aol.com

America Online, Inc.
Suite 400
1101 Connecticut Avenue, NW
Washington, DC 20036-4303

Dated: February 13, 1997

America Online, Inc. (AOL) submits the following comments on the Interim Rule released by the Commerce Department's Bureau of Export Administration (BXA) on December30. 1996.

Founded in 1985 and headquartered in Dulles, Virginia, AOL is the world's largest Internet online service, with approximately 8 million members and local dial-up access in 700 cities worldwide. Through its service, AOL provides consumers with original programming and informative content, e-mail capabilities, access to the World Wide Web and informational databases, electronic magazines and newspapers, and opportunities to participate in online conferences, which offer an interactive community that enhances learning, personal communication, and productivity. AOL was founded and operates today in a highly competitive global environment

While AOL applauds the Administration's stated intention to liberalize encryption export controls to ensure the success of global electronic commerce, AOL believes that the proposed regulations fall far short of where United States export policy must ultimately move if the U.S. is to retain its current leadership position in the global electronic marketplace. The current policy and process that assumes that encryption will primarily be used in situations that threaten United States national security, rather than to facilitate the development of global commerce, is fundamentally flawed. This policy ignores national security risks involved in such an approach including undermining U.S. leadership in the anticipated explosive growth of international electronic commerce over the next several years.

Instead, the Administration should focus on the fact that participation in the global marketplace is critical for all Americans and no longer applies solely to large corporate entities, but to smaller businesses and individual entrepreneurs as well. The advent of the Internet has brought with it opportunities for all Americans to contribute to the continued economic leadership of the United States. And, for an Internet online company like AOL, it is critical that we extend our services beyond our borders to remain competitive. Central to the success of AOL and its partners will be the ability to meet the security and privacy expectations of consumers in this rapidly evolving, global electronic marketplace.

In fact, recognizing the economic importance of global electronic commerce, the Administration has recently embarked on its own effort to adopt a coherent policy scheme that will help promote electronic commerce development and remove any barriers to the United States' continued lead in this area. Unfortunately, the Administration's efforts in the area of encryption policy impose a substantial risk of doing just the opposite.

AOL has become the leading Internet online provider in the United States. We are currently extending our market reach to major U.S. trading partners throughout the world, including ventures with leading companies in Europe and Asia, and we hope these steps mark only the beginning of the development of our global business.

In order to succeed in the Internet online marketplace, however, we must provide our subscribers all over the world with a level of security and privacy to protect customer assets and communications, including financial transactions, that meet their expectations. Without this level of protection, AOL and other U.S.-based Internet online companies will be unable to compete for online subscribers around the world and will ultimately lose the ability to compete in the global marketplace.

In addition, in order to serve Internet online customers in international markets, AOL must also be able to enter into agreements with local institutions to provide services like online banking. However, without the ability to use freely and export encryption technologies, meeting today's and tomorrow's commercial security and privacy standards, we will be prevented from doing so. In addition, the problems created by encryption export restrictions extend beyond securities and into difficult areas like interoperability problems among different networks and technologies. These fundamental problems are already standing squarely in the way of AOL's business development plans and the requirements of its partners and subscribers.

AOL has several specific objections to the Commerce Department's proposed rule specifically and the Administration's approach to encryption generally:

• While the transfer of jurisdiction for encryption export control to the Department of Commerce indicates a recognition that encryption policy is fundamentally about commerce, the Administration's policy in reality continues to treat encryption technologies as if they were munitions by liberalizing export restrictions only marginally and only after companies must pass through numerous vetting processes involving several agencies including the Department of Justice.

• Although the Administration has stated its support for a key "recovery" system that is developed by the private sector, the interim regulations illustrate that the focus remains on the notion of key escrow, requiring third-party participation. In addition, the level of government oversight in the key recovery development process -- i.e. the six-month review process -- indicates that it is the government, not the private sector, that will have ultimate control over the process;

• The policy liberalization to permit 56-bit encryption exports is insufficient because even this level of encryption is considered weak and insecure. It is also subject to continuous uncertainty as AOL's ability to export such encryption is subject to ongoing reviews which make it impossible for companies like AOL to enter into marketing agreements with foreign companies. In addition, many foreign companies are already demanding that U.S. companies support 128-bit encryption solutions; and

• The new policy continues to put American Internet online service providers, the businesses that rely on them, and companies that develop encryption since technology and software, at a significant competitive disadvantage as U.S. export controls do not prevent strong encryption from developing and being used abroad but rather foreclose those markets to U.S. companies. In the long term, U.S. companies may choose non-U.S. encryption technology since it will be better able to support a global marketplace.

AOL's objections to the Administration's encryption policies are not merely philosophical. On the contrary, U.S. encryption export controls are presently having a significant adverse impact on AOL's ability to conduct business in Europe and Asia.

To give just one example in the area of online banking, in Germany and the United Kingdom, most banks with which AOL is trying to partner have implemented, or have plans to implement, web sites with 40-bit SSL encryption supplemented with 128-bit encryption implemented with Java or browser plug-in technology. In Germany, which is the largest online banking market in Europe and is currently the European market in which AOL has the most members, those banks currently using or planning to use 128-bit web-based encryption technologies provide 70% of the online banking transactions in Germany today. Because of our inability to state with confidence that AOL can support 128-bit encryption, it has already become very difficult to enter into many business arrangements. Increasingly, as local Internet service providers in Europe are able to support 128-bit encryption, U.S. companies like AOL may well be completely shut out.

With users and companies around the world moving to stronger proposed encryption solutions for commerce and communications online, the U.S. export restrictions will continue to hamper the ability of American businesses to participate in the global marketplace, a new marketplace which by all accounts will explode as we approach the Millennium. AOL respectfully urges the Administration to go back to the drawing board and consider the needs of this country's businesses and citizens as more and more commerce moves out of the analog world and into the digital world of cyberspace.

Respectfully submitted,

Jill A. Lesser
Deputy Director, Law and Public Policy
Senior Counsel
America Online, Inc.

William W. Burrington
Director, Law and Public Policy
Assistant General Counsel
America Online, Inc.
Suite 400
1101 Connecticut Avenue, NW
Washington, DC 20036-4303
202/530-7880
BillBurr@aol.com

Thomas C. Dabney
Assistant General Counsel,
AOL International
America Online, Inc.
22000 AOL Way
Dulles. VA 20166-9323
703/265-2020
DabneyTC@aol.com

Dated: February 13, 1997

Hypertext by DN and JYA/Urban Deadline